CVE-2024-45835

LOW2.5EPSS 0.36%

Mattermost Desktop App fails to sufficiently configure Electron Fuses

Published: 9/16/2024Modified: 9/18/2024

Also known as:GHSA-xgq9-7gw6-jr5rBIT-mattermost-2024-45835

Description

Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access.

Affected packages (2)

Bitnami/mattermostfrom 0, < 5.9.0
npm/mattermost-desktopfrom 0, < 5.9.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
osv	CVSS 3.1	LOW2.5	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References (3)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-45835
PATCHhttps://github.com/mattermost/desktop
WEBhttps://mattermost.com/security-updates